ci: Add a security workflow

[steven-sheehy]

Description:

• Add a security workflow that runs:
  • CodeQL to provide static code analysis
  • PNPM audit to fail if any dependency has a high or critical vulnerability
  • Semgrep to provide additional static code analysis
• Change release workflow to a single command to set versions and update dependencies
• Change workflows to read PNPM and Node.js versions from package.json

Related issue(s):

Fixes #2852

Notes for reviewer:

Checklist

• Documented (Code comments, README, etc.)
• Tested (unit, integration, etc.)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.98%. Comparing base (2ea8f36) to head (57b6fd2).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3061   +/-   ##
=======================================
  Coverage   99.98%   99.98%           
=======================================
  Files         192      192           
  Lines        6052     6117   +65     
  Branches     1096     1121   +25     
=======================================
+ Hits         6051     6116   +65     
  Misses          1        1           

see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[swirlds-automation]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

Adds a dedicated “Security” GitHub Actions workflow to continuously scan the repo for vulnerabilities and security issues, and standardizes CI/release workflows to derive Node.js and pnpm versions from package.json for easier maintenance and consistency.

Changes:

• Introduces .github/workflows/security.yaml to run CodeQL, pnpm audit (high/critical), and Semgrep (SARIF upload).
• Updates multiple workflows to use actions/setup-node with node-version-file: package.json and pnpm caching; adds LC_ALL: C.UTF-8 where needed.
• Updates release automation to bump versions via a single workspace-wide command and simplifies lockfile updates.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
package.json	Adds packageManager for pnpm and tightens Node engine range used by workflows.
.gitignore	Ignores SARIF outputs generated by security scans.
.github/workflows/test-migrations.yaml	Standardizes locale and Node/pnpm setup via package.json.
.github/workflows/test-frontend.yaml	Standardizes locale and Node/pnpm setup; pins upload-artifact action SHA.
.github/workflows/test-backend.yaml	Standardizes locale and Node/pnpm setup via package.json.
.github/workflows/smoke-test-mac.yaml	Switches to setup-node pnpm caching; bumps Python version used in workflow.
.github/workflows/security.yaml	Adds new security workflow (CodeQL, pnpm audit, Semgrep + SARIF upload).
.github/workflows/release-automation.yaml	Simplifies version bumping/lockfile updates; updates caching and install behavior.
.github/workflows/pr-formatting.yaml	Adds locale environment standardization.

Comments suppressed due to low confidence (1)

.github/workflows/release-automation.yaml:311

• actions/setup-node is already configured with cache: pnpm, so the additional manual pnpm-store lookup + actions/cache step is redundant and can slow down the workflow / add complexity. Consider removing the extra cache steps and relying on the built-in pnpm caching.

      - name: Get pnpm store directory
        id: pnpm-store
        run: echo "path=$(pnpm store path --silent)" >> $GITHUB_OUTPUT

      - name: Cache pnpm store

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jbair06]

LGTM

[jbair06]

Recreating PR